Expand the common DKIM selector probe list

[sage-s11]

Probe additional stable, documented selectors used by major providers so DKIM presence is less often reported as undetected. Skip per-tenant dynamic selectors.

Summary

DKIM presence is probed from COMMON_DKIM_SELECTORS in src/sentineldeck/scanners/email_security.py. A miss is inconclusive, so a short list produces false "not detected" results for domains that only publish a well-known provider selector we were not checking.

This expands the list with static, publicly documented selectors used by major providers (Google Workspace, Microsoft 365, Mailchimp, Mandrill, SendGrid, Zoho, Proton Mail, Fastmail, Apple iCloud, Yahoo/AOL legacy, Zendesk, Brevo). Each entry has a short provider comment. Per-tenant / generated selectors are still omitted (Amazon SES tokens, Postmark dated selectors, HubSpot hs1-<portalId>, etc.).

Closes #7

Changes

• Expand COMMON_DKIM_SELECTORS with documented static selectors and
  provider comments.
• Add a unit test that the list is unique and includes the new
  documented names.

Checklist

• ruff check . passes
• pytest -q passes
• New behaviour has tests (network calls mocked)
• The change is passive-safe (no intrusive scanning)
• README / CHANGELOG updated if user-facing

[sanmaxdev]

Checked the expanded selector set against issue #7 and the passive lookup path. The change stays scoped and preserves inconclusive handling for misses.

Passed:

• ruff check .
• mypy
• pytest -q --cov=sentineldeck --cov-fail-under=75 (261 passed, 81.09% coverage)
• bandit -r src -c pyproject.toml
• git diff --check origin/main...HEAD